Extracted

• • Target
    BoletaServiPlusFechaJunioFact.lnk
  • Size 3KB
  • SHA256 807e3170312eb23fc1cba8db4fdf6026e1ffaf62ab4e3c494c777ef601a3d430
  • MD5 b70af532c90c10540a47a815a9f091d9
  • SHA1 c0d739132e30a3a5547f112d68775e6095b9782f
  • SHA512 9ba7f8c3eefd88b053bc285202af3f0666c4ffb0e9625b9d5283bd7bfa0654c039cf31a7426c31adc098508a670473d651d5393602060b2e20c19653e4fe331c
  • TLSH
    T1AB712A112DE621D8F3334B7527DCB6BB49A7F4B9A92EA6F8200145844770994ECB1F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2